Ledger
A French cryptocurrency hardware wallet manufacturer specializing in the production of cold wallets and other blockchain secure storage devices. Ledger is a leading brand in the global hardware wallet market, offering physical devices designed to store private keys offline and protect digital assets from online threats.
Timeline (last 90 days)
In 2023, a supply chain attack targeting the Ledger Connect Kit occurred.
In 2020, Ledger had a customer data leak incident.
Attackers obtained the wallet's private key or signing information by implanting tiny spy chips during the device production or distribution stage.
Ledger advises users to update the firmware immediately and verify the authenticity of the device through the official app.
Public information is currently limited, and whether a direct causal relationship exists between the hidden chip and the $92 million theft allegations remains inconclusive.
Ledger has acknowledged the presence of a hidden chip in its cryptocurrency wallet.
Ledger's devices use commercial secure chips supplied by NXP or STMicroelectronics, whose internal firmware is managed as closed-source by the manufacturer.
Ledger Recover is an optional paid service launched by Ledger in 2023 that allows users to encrypt and split their seed phrase for custodial storage across three third-party institutions, enabling recovery of access through identity verification if the device is lost.
The architecture of Ledger Recover logically demonstrates that private key material can leave the Secure Element in some form, contradicting Ledger's previous official statement that private keys never leave the device.
After the Ledger Recover controversy escalated, Ledger released partial open-source commitments for its firmware, but the core Secure Element firmware remains closed-source.
8 more timeline events
All Facts (17)
Ledger advises users to update the firmware immediately and verify the authenticity of the device through the official app.
50%UnverifiedAttackers obtained the wallet's private key or signing information by implanting tiny spy chips during the device production or distribution stage.
50%UnverifiedAfter the Ledger Recover controversy escalated, Ledger released partial open-source commitments for its firmware, but the core Secure Element firmware remains closed-source.
50%UnverifiedPublic information is currently limited, and whether a direct causal relationship exists between the hidden chip and the $92 million theft allegations remains inconclusive.
50%UnverifiedCombining hardware wallets from different manufacturers (for example, Ledger + Trezor + Coldcard) to build a multisig strategy can mitigate the trust risk associated with a single vendor.
50%UnverifiedLedger Recover is an optional paid service launched by Ledger in 2023 that allows users to encrypt and split their seed phrase for custodial storage across three third-party institutions, enabling recovery of access through identity verification if the device is lost.
50%UnverifiedThe architecture of Ledger Recover logically demonstrates that private key material can leave the Secure Element in some form, contradicting Ledger's previous official statement that private keys never leave the device.
50%UnverifiedLedger's devices use commercial secure chips supplied by NXP or STMicroelectronics, whose internal firmware is managed as closed-source by the manufacturer.
50%UnverifiedMainstream manufacturers such as Ledger have introduced Secure Element chips and firmware signature verification mechanisms, but these are predicated on the device not having been tampered with after leaving the factory.
50%UnverifiedPlain text accounting is represented by tools such as Ledger and hledger, which store income and expense records as human-readable text files.
50%UnverifiedIn 2020, Ledger had a customer data leak incident.
50%UnverifiedIn 2023, a supply chain attack targeting the Ledger Connect Kit occurred.
50%UnverifiedLedger has acknowledged the presence of a hidden chip in its cryptocurrency wallet.
50%UnverifiedMultiple Ledger cryptocurrency wallet users have reported that their account assets were completely transferred out.
50%UnverifiedThe investigation points to allegedly tampered hardware devices sold by third-party distributor CryptoBillis.
50%UnverifiedLedger has confirmed that the device of one of the affected users does indeed exhibit abnormalities.
50%UnverifiedLedger has officially requested that CryptoBillis suspend sales of all its wallet products and launch an investigation.
50%